Upgrade to Pro — share decks privately, control downloads, hide ads and more …

[初心者向け]AWS環境のセキュリティ運用(設計)をはじめてみよう

 [初心者向け]AWS環境のセキュリティ運用(設計)をはじめてみよう

Avatar for cm-usuda-keisuke

cm-usuda-keisuke

February 23, 2019
Tweet

More Decks by cm-usuda-keisuke

Other Decks in Technology

Transcript

  1. ӡ༻ͰͷηΩϡϦςΟͷΠϝʔδ   w ͭΒ͍ w ͍ͨ΁Μ w ੹೚ॏେ w

    ϧʔνϯϫʔΫ w ͭ·Βͳ͍ Ͳ͏ͯ͜͠ΜͳΠϝʔδʹͳΔͷ͔ʁ
  2. ࣮ࡍͲΜͳ͜ͱΛ΍͍ͬͯΔ͔   w ηΩϡϦςΟάϧʔϓͷઃఆΛมߋ͢Δ w Ϧιʔεͷ؂ࢹ ϝτϦΫεͷಈ͖ͷ֬ೝͱ͔  w

    ϩάʹมͳ΋ͷ͕ͳ͍͔֬ೝ͢Δ w ੬ऑੑͷ֬ೝ w ύονΛ౰ͯΔ w ଞʹ΋͍Ζ͍Ζ ຊ౰ʹਓྗͰ΍Δඞཁ͕͋Γ·͔͢ʁ
  3. ҰൠతʹηΩϡΞͳߏ੒   w ࡾ૚ωοτϫʔΫ w ϑϩϯτҎ֎͸ϓϥΠϕʔτ w Ϛϧν"; w

    "VUP4DBMJOH w ֎෦௨৴͸/"5ܦ༝ w ඞཁʹԠ͡$MPVE'SPOU΍ 8"'Λಋೖ
  4. ࠷௿ݶͷϥΠϯ   w Ϛϧν";Ͱ৑௕Խ͢Δ w ";ো֐͕ͳͯ͘΋Πϯελϯε͕ࢮ͵Մೳੑ͕͋Δ w ϦλΠΞϝϯτ΍αʔό಺ͷϝϞϦϦʔΫͳͲ w

    αʔϏε͕গ͠ࢭ·͍͍ͬͯͳΒγϯάϧ";Ͱ΋͍͍ w "VUP4DBMJOH(SPVQʹೖΕΔ w Πϯελϯε୆Ͱ΋࢖͏ w ো֐࣌ʹࣗಈ෮چͯ͘͠ΕΔ w ΠϯελϯεΛࣗಈతʹɾ؆୯ʹ૿΍ͤΔ ౰ॳ༧ఆ͕ͳͯ͘΋ٸ ʹ૿΍ͨ͘͠ͳͬͨͱ͖ʹศར
  5. ΋͏গ͠ؤுΔͳΒ   w $MPVE'SPOUͰ੩తίϯςϯπΛΩϟογϡ͢Δ w ΞΫηε͕େྔʹདྷͯ΋අ༻ΛकΕΔ w ͳΜͳΒόοΫΤϯυΛ4ʹ͢Δ w

    ϛυϧ΢ΣΞ͕ͳ͘ͳΔͷͰ੬ऑੑ؅ཧָ͕ʹ w "848"'Λ࢖͏ w ༻్ʹ߹ΘͤͨϚωʔδυϧʔϧΛ࢖͏ͱָʹ׆༻Ͱ͖Δ w ཁ͕݅໌֬ͳΒݸผʹϧʔϧΛνϡʔχϯά
  6. 4FDVSJUZ(SPVQͷ࢖͍ํ   w /"$-͸࠷௿ݶʹͯ͠ΞΫηε੍ݶ͸جຊ4(دͤ w Ϧιʔεʹෳ਺4(ΞλονՄೳͳͨΊɺ໾ׂ͝ͱͷ4(Λ࡞੒͢ΔɻҎԼྫ w &-#4(&-#༻ɻQPSUΛڐՄ͢Δ w

    8FC4(8FCαʔό༻ɻ&-#4(͔ΒͷΛڐՄ w 0GpDF4(0GpDF͔Βͷ؅ཧΞΫηε  ΛڐՄ w ໾ׂؒ͸4(ͷ*%ͰڐՄ͢Δ αϒωοτͷ*1Ϩϯδ͸࢖Θͳ͍  w Ұ࣌తͳ࡞ۀ͸4(ʹ*1Λ௥هͰ͸ͳͯ͘ɺ࡞ۀ༻4(ΛΞλον͢ΔΑ͏ʹ͢Δ w ࡞ۀϛεͰϧʔϧΛফͨ͠Γ͢Δ͜ͱ͕ͳ͘ͳΔ w ܁Γฦ͠ߦ͏ͱ͖ʹ࢖͍΍͍͢
  7. *".ͷ؅ཧ͸Ԟ͕ਂ͍͚Ͳɺख͸ൈ͔ͳ͍Α͏ʹ   w ਓ͕࢖͏*".6TFS͸.'"ඞਢ w ਓ͕࢖Θͳ͍*".6TFS͸࠷௿ݶͷΈ w *".3PMF͕࢖͑Δ৔߹͸3PMFΛ࢖͏ w

    ෳ਺ΞΧ΢ϯτΛ·͕ͨΔ৔߹ɺͭͷΞΧ΢ϯτʹਓ͕࢖͏*".6TFSΛ ू໿ͯ͠ɺ4XJUDI3PMF͢Δ w ΫϨσϯγϟϧ͕୔ࢁੜ੒͞Εͳ͍ͷͰ؅ཧ͠΍͍͢ w *".3PMF͸৭Μͳ৔໘Ͱ࡞੒͢Δඞཁ͕͋ΔͨΊɺ؅ཧऀ͕ੜ੒͢ΔΑ͏ ʹ͢Δͱਏ͍ w ՄೳͳݶΓϦςϥγʔڭҭͱ"84$POpHϧʔϧΛ׆༻ͯ͠։ൃऀͰ΋࡞੒Ͱ͖ ΔΑ͏ʹ͢Δ
  8. ͋Δ͋Δࣦഊྫ   w εΫϦϓτ౳Ͱ*1΍Πϯελϯε*%ΛݻఆύϥϝʔλͰࢦఆ͢Δ w 3%4΍&-#ͷࢦఆ͸'2%/Λ࢖͏ w Πϯελϯε*%౳͸BXTDMJϝλσʔλΛ׆༻ w

    ಈతͳ஋͸ຒΊࠐ·ͣ44.ύϥϝʔλετΞΛ׆༻ w &$͕"VUP4DBMJOHͰೖΕସΘͬͯϩά͕࢒͍ͬͯͳ͍ w ϩά͸qVFOUE౳Ͱ4ʹग़͢ w 4ʹग़ͨ͠ϩά͸44FMFDU΍"UIFOBͰݕࡧՄೳ w $MPVE8BUDI"HFOUͰ$MPVE8BUDI-PHTͰ΋͍͍
  9. &$पΓͷ؂ࢹϝτϦΫεྫ   w "-#5BSHFU(SPVQͷϝτϦΫεͰશମΛ֬ೝ w $POTVNFE-$6Tෛՙঢ়گͷ֬ೝ w 5BSHFU3FTQPOTF5JNFόοΫΤϯυ͔ΒͷϨεϙϯελΠϜ w

    6O)FBMUIZ)PTU$PVOUϨεϙϯε͕ͳ͍ϗετͷ֬ೝ w )551$PEF@5BSHFU@99@$PVOUαʔόΤϥʔͷΧ΢ϯτ w ݸผͷ&$Ͱ֬ೝ w $166UJMJ[BUJPO$16࢖༻཰ w .FNPSZ6UJMJ[BUJPO ΧελϜϝτϦΫε ϝϞϦ࢖༻཰ w %JTL6TBHF ΧελϜϝτϦΫε σΟεΫ࢖༻཰ w $16$SFEJU#BMBODFόʔετΠϯελϯεͷ৔߹ͷ࢒ΓΫϨδοτ
  10. ΞϥʔϜΛઃఆ͢Δ   w ͱΓ͋͑ͣᮢ஋͸ෳ਺ઃఆ͓͚ͯ͠͹͍͍    ͱ͔ 

    w ௨஌དྷͨΒͲ͏͢Δ͔΋ܾΊ͓ͯ͘ w SFTUBSUIUUQEࣗಈԽͰ͖Δ w &$࠶ىಈࣗಈԽͰ͖Δ w &$࡟আͪΌΜͱ"VUP4DBMJOHͷઃఆ͓ͯ͘͠ w ௨஌಺༰͸ϝʔϧ௚ͩͱݟͮΒ͍͔Β੔ܗͯ͠4MBDLͱ͔ʹ ग़ͨ͠Β͍͍
  11. 44.ͷίϯϙʔωϯτΛগ͠঺հ   w "VUPNBUJPO w ࣗಈԽυΩϡϝϯτΛఆٛͯ͠ɺखॱ௨Γʹࣗಈ࣮ߦ w ҎԼͷΑ͏ͳϫʔΫϑϩʔΛఆٛͰ͖Δ w

    &$Λ"VUP4DBMJOH͔Β੾Γ཭͠ w &$Λఀࢭ w ".*Λऔಘ w &$ͷىಈ w &$Λ"VUP4DBMJOHʹ໭͢ Automation
  12. 44.ͷίϯϙʔωϯτΛগ͠঺հ   w 1BUDI.BOBHFS w ύονͷϧʔϧ ϕʔεϥΠϯ Λఆٛͯ͠ύονΛ؅ཧ w

    ϕʔεϥΠϯͷྫ w ෼ྨ͕4FDVSJUZͰॏཁ౓͕$SJUJDBMͷύον͸͙͢ద༻ w ͦΕҎ֎͸ϦϦʔε೔ޙʹద༻ w ύονͷద༻͸3VO$PNNBOE౳͔Β࣮ࢪ w ঢ়گΛ֬ೝ͢Δ4DBOͱద༻΋ߦ͏*OTUBMMΛબ΂Δ w 8JOEPXT4FSWFS΍֤छ-JOVY΋ରԠ Patch Manager
  13. ύονద༻ࣗಈԽͷͨΊʹߟ͑Δ͜ͱ   w σάϨ΍ΞϓϦ΁ͷࢧো͕ग़ΔՄೳੑ͸ݕূ؀ڥͰ௵͢ w ·ͣ͸ݕূ؀ڥͰࣗಈతʹద༻͔ͯ͠Β໰୊ͳ͚Ε͹ຊ൪؀ڥʹ΋ద༻ ͢Δ w ਖ਼ৗͱ൑அ͢Δج४͸ઃ͚͓ͯ͘

    w )551ΞΫηε͕ਖ਼ৗͳΒ͍͍ͷ͔ w ಛఆͷಈ࡞Λ֬ೝ͢Δͷ͔ w ςετέʔε͕ແ͍ͷʹ൑அ͢Δͷ͸ແཧ w ਖ਼ৗੑςετΛࣗಈԽ͢Δ w ཧ૝ w ೔࿨ݟΞοϓσʔτ΋͋Γ w όοΫΞοϓ͔Βͷ෮چखॱཱ͕͍֬ͯ͠Ε͹ɺΨϯΨϯ্͛Ε͹͍͍
  14. ॲཧ಺༰   w "VUP4DBMJOH͔Β୆ΠϯελϯεΛબͿ w "VUP4DBMJOH͔Β੾Γ཭͢ 4UBOECZ  w

    ύονͷద༻ w ΠϯελϯεΛ໭͢ w Πϯελϯε͕ͳ͘ͳΔ·Ͱ܁Γฦ͢
  15. ηΩϡϦςΟӡ༻ࣗಈԽͷεεϝ   w ࣗಈԽ͢ΔͨΊͷઃܭΛ͔ͬ͠Γߦ͏ w ݕূ؀ڥɾςετख๏ɾධՁج४ w ύονϕʔεϥΠϯͷઃఆ w

    ύονద༻ॱং౳ͷઃܭ w ্ه͸ͲͷΈͪ͋Μ·ΓܾΊͳ͍Ͱӡ༻ʹؙ౤͛ͨ͠Βɺ ӡ༻Ͱۤ࿑͢Δ͔ΒઃܭͰ΍Δ w ઃܭͰ͖ͨͳΒࣗಈԽ͠Α͏
  16. ͓·͚   w ʮ4Ͱޡͬͨσʔλͷެ։Λ๷͙ύϒϦοΫΞΫηεઃఆػೳ͕௥ Ճ͞Ε·ͨ͠ʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTTCMPDLQVCMJDBDDFTT w ΄΅͢΂ͯͷ"84Ϣʔβ͕͜ͷઃఆΛࠓ͙͢༗ޮԽ͢΂͖4ͷσʔλ

    ΛकΔػೳ w ʮ$MPVE5SBJMͷηΩϡϦςΟ؂ࢹΛͪΐʔ؆୯ʹ΍ͬͯΈͨ ʲ4VNP-PHJDʳʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTDMPVEUSBJMTFDVSJUZBOBMZUJDTXJUITVNPMPHJD w "84ηΩϡϦςΟͷͨΊͷϩά෼ੳΛ؆୯ʹߦ͏ํ๏
  17. ͓·͚   w ʮ<଎ใ>ηΩϡϦςΟ৘ใΛҰׅͰ؅ཧͰ͖Δ"844FDVSJUZ )VC͕ൃද͞ΕͨͷͰ࢖ͬͯΈ·ͨ͠ʂSFJOWFOUʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTSFJOWFOUTFDVSJUZ IVC w

    ৽ػೳ4FDVSJUZ)VCͰηΩϡϦςΟ৘ใͷҰׅ؅ཧ w ʮ<Ϩϙʔτ>4&$"84ͷϑΥϨϯδοΫΛαʔόϨεʹߦ ͏ํ๏SFJOWFOUʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTSFJOWFOUTFDSFQPSU w &$ͷϑΥϨϯδοΫΛαʔόϨεʹ࣮ݱ͢ΔTTNBDRVJSFͷ঺հ
  18. ͓·͚   w ʮ"848"'ͷϩάΛ'JSFIPTFͰ4ʹग़ྗ͠ϒϩοΫϩ άΛ44FMFDUͰ֬ೝͯ͠Έͨʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTBXGXBGDPNQSFIFOTJWFMPHHJOH w "848"'ͷϩάऔಘํ๏

    w ʮ"848"'ͷϑϧϩάΛ"UIFOBͰ෼ੳͰ͖ΔΑ͏ʹͯ͠ Έͨʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTRVFSZBXTXBGGVMMMPHCZBUIFOB w "848"'ͷϩά෼ੳํ๏
  19. ͓·͚   w ʮ",*#""84Ͱʮ"84ݻ༗ͷηΩϡϦςΟϦεΫͱ ରࡦʯͱ͍͏λΠτϧͰ஻Γ·ͨ͠ʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTBLJCBBXTTQFDJpDBXTTFDVSJUZ w "84ݻ༗ͷϦεΫ΋͋Γ·͢

    w ʮ4FDVSJUZ+"84ୈճϨϙʔτTFDKBXT TFDKBXTKBXTVHʯ w IUUQTEFWDMBTTNFUIPEKQDMPVEBXTTFDVSJUZKBXTSFQPSU w 4FDVSJUZ+"84ͷϨϙʔτ